CJFA Privacy & Cookies Policy

About This Policy

This Privacy and Cookies Policy explains how C.J. Falconer & Associates, trading as CJ Falconer Architects (“CJFA”, “we”, “us” or “our”), collects, uses and otherwise processes personal data in connection with our website, www.cjfa.ie.

For the purposes of the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018, C.J. Falconer & Associates is the controller of the personal data described in this Policy.

Our contact details are:

C.J. Falconer & Associates, trading as CJ Falconer Architects
St. Patrick’s House
Newtown
Waterford
X91 RR76
Ireland

Email: mail@cjfa.ie
Telephone: +353 (0)51 878888

This Policy explains:

what personal data we collect;
how and why we use personal data;
the lawful bases on which we rely;
when personal data may be shared with service providers or other recipients;
how long we retain personal data;
how we use cookies and similar technologies;
whether personal data may be transferred outside the European Economic Area (“EEA”); and
the data-protection rights available to you.

If you have any questions about how CJFA processes personal data, you can contact us using the details above.

What Personal Data We Collect

The personal data we collect depends on how you interact with our website.

Information You Provide to Us

We may collect personal data that you provide when you:

subscribe to our email newsletter;
contact us by email or telephone; or
otherwise communicate with us in connection with our practice or services.

This information may include:

your name;
your email address;
your telephone number;
the name of your organisation;
information concerning a project, enquiry or potential collaboration; and
any other personal data you choose to include in your communication.

When you subscribe to our email newsletter, we request your name and email address. We also retain a record of your subscription and consent preferences.

Please avoid providing personal data that is not relevant or necessary for your enquiry.

Information Collected Automatically

When you visit our website, certain technical information may be processed automatically by our website, hosting provider and security systems. This may include:

your Internet Protocol (“IP”) address;
the date and time of your visit;
the pages or resources requested;
the referring website or page;
your browser type and version;
your device and operating-system information; and
technical information associated with errors, security events or attempted misuse of the website.

This information may be recorded in server, security or diagnostic logs.

We also use Google Analytics to collect information about how visitors interact with our website. Google Analytics and other non-essential technologies should only be activated after you have provided the required consent. Further details are provided in the section headed “Cookies and Similar Technologies”.

Information Processed for Website Security

The website may use automated security and anti-spam services to protect its forms and other functions from fraudulent or abusive activity. These services may process technical information about your device, browser, IP address and interaction with the website.

Further information about the relevant providers is provided in the sections headed “Third-Party Service Providers” and “International Transfers”.

How and Why We Use Personal Data

We only process personal data where we have a specific purpose and a lawful basis for doing so.

The purposes for which we may use personal data collected through, or in connection with, this website are set out below.

Purpose	Personal Data Used	Lawful Basis
To receive, assess and respond to project enquiries, general enquiries and requests for information	Name, contact details, organisation, project or enquiry information, and correspondence	Our legitimate interests in communicating with prospective clients, collaborators and other interested parties; or taking steps at your request before entering into a contract
To communicate with existing clients, consultants, contractors and other professional contacts	Name, professional contact details, organisation and correspondence	Performance of a contract, where you are a party to that contract; or our legitimate interests in managing our professional and business relationships
To manage subscriptions to our email newsletter and send practice, project and other relevant updates	Name, email address, subscription record and consent preferences	Your consent
To maintain evidence of newsletter consent and record unsubscribe requests	Email address, consent record, subscription status and relevant dates	Compliance with our legal obligations and our legitimate interests in demonstrating compliance and ensuring that marketing preferences are respected
To operate, maintain and secure the website	IP address, browser and device information, server logs, security events and related technical information	Our legitimate interests in providing a functional and secure website, preventing misuse and protecting our systems
To identify and resolve technical problems	Device, browser, error, diagnostic and server-log information	Our legitimate interests in maintaining and improving the reliability and performance of the website
To measure and understand how the website is used through Google Analytics, where you have consented	Cookie identifiers, IP address, device information and information about interactions with the website	Your consent
To comply with applicable laws and respond to lawful requests from courts, regulators or public authorities	Personal data relevant to the applicable obligation or request	Compliance with our legal obligations
To establish, exercise or defend legal claims	Relevant contact information, correspondence, technical information and other information connected with the claim	Our legitimate interests in protecting and exercising our legal rights

Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and whether they are overridden by your rights and interests.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

We do not sell personal data collected through our website.

Cookies and Similar Technologies

What Are Cookies?

Cookies are small text files stored on your computer, mobile device or other internet-enabled device when you visit a website. Cookies can help a website operate correctly, maintain security, remember preferences and provide information about how the website is used.

Similar technologies, including local storage, pixels and tags, may perform related functions. References to “cookies” in this section include these similar technologies where appropriate.

How We Use Cookies

Our website uses, or may use, the following categories of cookies and similar technologies.

Strictly Necessary Cookies

These cookies are required for the website to operate securely or provide functions requested by visitors. They may be used for purposes such as website security, network management, form operation and recording cookie preferences.

Strictly necessary cookies do not require consent. We limit their use to functions necessary for the operation of the website.

Analytics Cookies

We use Google Analytics to help us understand how visitors use our website. Google Analytics may collect information concerning visits to the website, including:

pages viewed;
approximate location derived from an IP address;
the date, time and duration of a visit;
the referring website or page;
browser and device information; and
interactions with website content.

We use this information to understand overall patterns of website use and to help us maintain and improve the website.

Google Analytics cookies and related technologies are not strictly necessary for the website to operate. We only activate these technologies after you have consented to analytics cookies through our cookie controls.

More information about how Google processes personal data is available in Google’s Privacy Policy.

Embedded Video and Media

Some pages may contain video or other media embedded from third-party services. When embedded content is activated, the relevant provider may use cookies or similar technologies and may receive technical information, including your IP address, browser and device information and information about your interaction with the content.

Where consent is required, we only activate third-party embedded content and its associated technologies after you have made the relevant choice through our cookie controls.

Information identifying the video and media providers used by the website will be added following completion of our current technical review.

Google Maps

Our website may use Google Maps to display maps and location information. When Google Maps content is activated, Google may receive information including your IP address, browser and device information and information about your interaction with the map.

Where consent is required, we only activate Google Maps and its associated technologies after you have made the relevant choice through our cookie controls.

Further information is available in Google’s Privacy Policy.

Cookie Consent

When you first visit our website, our cookie banner provides information about the categories of cookies and similar technologies used and allows you to accept, reject or manage non-essential technologies.

Strictly necessary cookies may be used without consent. Analytics, embedded-media and other non-essential technologies are only activated after you have provided the required consent.

You can change or withdraw your consent at any time through the Cookie Settings control provided on our website. Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

You can also configure your browser to block or delete cookies. Browser controls may not prevent every form of local storage or similar technology. Blocking strictly necessary technologies may affect the availability or operation of certain website functions.

Further Cookie Information

We are carrying out a technical review of the cookies and similar technologies used by the recently updated CJFA website. Following completion of that review, this section will be updated with further information concerning the individual cookies used, their providers, purposes, categories and retention periods.

Email Newsletter and Direct Marketing

You may choose to subscribe to our email newsletter to receive news and updates concerning CJFA’s practice, projects, people, events and publications.

When you subscribe, we collect your name and email address. We also retain information associated with your subscription, including the date and method of subscription, your consent status and any subsequent changes to your preferences.

We send our email newsletter on the basis of your consent. Subscription is voluntary and is not a condition of using our website, contacting us or making an enquiry.

We use Mailchimp, a specialist email-marketing service, to administer our mailing list and distribute newsletter communications. Further information about Mailchimp, including any processing or transfer of personal data outside the European Economic Area, is provided in the sections headed “Third-Party Service Providers” and “International Transfers”.

You may withdraw your consent and unsubscribe at any time by:

selecting the unsubscribe link included in any newsletter email; or
contacting us at mail@cjfa.ie.

If you unsubscribe, we may retain limited information, including your email address, unsubscribe status and relevant dates, on a suppression list. This allows us to respect your preference and avoid sending further newsletter communications to you inadvertently.

Withdrawing your consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

When We Share Personal Data and Third-Party Service Providers

We do not sell personal data. We only share personal data where this is necessary for the purposes described in this Policy, where required by law or where you have provided the relevant consent.

Personal data may be shared with the following categories of recipients:

Website Hosting and Technical Support

Our website is hosted by Hosting Ireland. Hosting and infrastructure providers may process technical information, server logs and information submitted through the website as necessary to host, operate, secure and back up the website.

Cherrybird assists CJFA with the development, maintenance and administration of the website and may have access to personal data where necessary to provide those services.

Website Forms

We use Fluent Forms to operate our newsletter subscription form. Information entered into the form is processed through the CJFA website and transferred to our email-marketing provider.

We are confirming whether Fluent Forms also retains a copy of each submission within the website’s WordPress administration system. This section will be updated if necessary following completion of that review.

Email and Communications

We use Microsoft 365 to manage our business email and communications. Microsoft may process personal data contained in emails and related correspondence on our behalf.

Email Marketing

We use Mailchimp to manage newsletter subscriptions and distribute email communications. Mailchimp processes subscribers’ names, email addresses, subscription status, consent information and other information necessary to administer the mailing list.

Further information is available in Mailchimp’s Privacy Statement.

Google Services

We use Google Analytics to understand how visitors use our website. We may also use Google Maps to display maps and location information.

Where these services are activated, Google may receive technical and usage information, including IP addresses, cookie identifiers, browser and device information and information about interactions with the relevant service.

Further information is available in Google’s Privacy Policy.

Embedded-Media Providers

Pages on our website may contain video or other media provided through third-party services. When this content is activated, the relevant provider may receive technical information and information about your interaction with the embedded content.

The identity of the relevant video and media providers will be added following completion of our current technical review.

Professional Advisers and Public Authorities

We may disclose personal data to our professional advisers, including legal, accounting, insurance and information-technology advisers, where reasonably necessary to obtain advice, manage risk or establish, exercise or defend legal claims.

We may also disclose personal data where required by law, court order or a lawful request from a regulator, law-enforcement body or other public authority.

Safeguards Applying to Service Providers

Where a service provider processes personal data on our behalf, we require it to use that information only for the agreed purposes, to protect it appropriately and to comply with applicable data-protection law.

Some third-party providers may process personal data for their own purposes and under their own privacy policies. Where these providers use cookies or similar technologies through our website, we request consent where required.

Information about transfers of personal data outside the EEA is provided in the section headed “International Transfers”.

International Transfers

CJFA is based in Ireland and seeks to use service providers that protect personal data in accordance with applicable European data-protection law.

Some of our service providers operate internationally or may process personal data in countries outside the European Economic Area (“EEA”), including the United States. These providers may include Mailchimp, Google, Microsoft and certain website, security or embedded-media service providers.

Countries outside the EEA may not provide the same level of legal protection for personal data as countries within the EEA. Where personal data is transferred outside the EEA, we take steps to ensure that an appropriate transfer mechanism and safeguards are in place. Depending on the provider and destination, these may include:

a decision by the European Commission confirming that the destination provides an adequate level of data protection;
the European Commission’s approved Standard Contractual Clauses;
participation by an eligible United States organisation in the EU-U.S. Data Privacy Framework; or
another transfer mechanism permitted under data-protection law.

Mailchimp is operated by The Rocket Science Group LLC, part of Intuit, and may process personal data in the United States and other countries. Intuit and Mailchimp state that they participate in the EU-U.S. Data Privacy Framework and use the European Commission’s Standard Contractual Clauses where applicable.

Further information is available in Intuit’s Global Privacy Statement.

Information about Google’s data-processing and international-transfer practices is available in Google’s Privacy Policy.

You may contact us at mail@cjfa.ie if you would like further information about the safeguards applying to an international transfer of your personal data.

How Long We Retain Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, contractual, accounting or reporting requirements and to establish, exercise or defend legal claims.

The applicable retention period depends on the nature of the information and the purpose for which it is processed.

Enquiries and Correspondence

General and prospective-project enquiries will normally be retained for up to two years following our last substantive communication.

If an enquiry develops into a client, contractual or other professional relationship, the relevant information may become part of our client or project records and may be retained for a longer period in accordance with our legal, contractual and professional obligations.

Newsletter Subscriptions

We retain your name, email address, subscription information and consent record while you remain subscribed to our newsletter.

If you unsubscribe, we may retain evidence of your consent and subsequent withdrawal for up to three years, where necessary to demonstrate compliance with our legal obligations.

We may retain the minimum information necessary, including your email address and unsubscribe status, on a suppression list for longer where this is required to ensure that we continue to respect your request not to receive marketing communications.

Website and Form Records

Where newsletter submissions or other website records are retained within our website or its administration system, they will be kept only for as long as necessary to administer the relevant request, maintain appropriate records and demonstrate compliance.

The precise retention period applying to information stored through Fluent Forms is being confirmed as part of our current technical review.

Server, Security and Diagnostic Logs

Server, security and diagnostic logs are retained only for as long as reasonably necessary to operate and secure the website, investigate technical problems and detect or respond to misuse.

The precise retention periods applied by our hosting and technical service providers are being confirmed as part of our current technical review.

Analytics and Cookie Information

Information collected through Google Analytics and other cookie-based technologies is retained in accordance with the settings applied to those services and the retention periods described in our cookie information.

We are confirming the retention settings currently applied to Google Analytics and the other cookies and similar technologies used by the website. The relevant periods will be added following completion of our technical review.

Legal and Regulatory Requirements

In some circumstances, we may retain personal data for longer where required by law or where necessary to establish, exercise or defend a legal claim, respond to a dispute, comply with a regulatory requirement or protect the rights of CJFA or another person.

When personal data is no longer required, we will delete it, anonymise it or otherwise dispose of it securely. Information contained in routine backups may remain until the relevant backup is securely overwritten or deleted in accordance with the applicable backup schedule.

How We Protect Personal Data

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, use, alteration, disclosure or destruction, and against accidental loss or damage.

These measures may include:

limiting access to personal data to personnel and service providers who require it for an authorised purpose;
using access controls and authentication measures;
maintaining and updating our website and related systems;
using appropriate security, backup and recovery measures;
requiring relevant service providers to protect personal data appropriately; and
reviewing our information-handling and security practices where appropriate.

Personnel and service providers who are permitted to access personal data are required to handle it securely and confidentially.

While we take reasonable steps to protect personal data, no website, email service or method of transmission over the internet can be guaranteed to be completely secure. You should therefore take care when deciding what information to send to us electronically.

If we become aware of a personal-data breach, we will assess and respond to it in accordance with our obligations under applicable data-protection law, including notifying the Data Protection Commission and affected individuals where legally required.

Your Data-Protection Rights

Subject to the conditions and limitations set out in data-protection law, you may have the following rights in relation to your personal data:

Right of access: You may request confirmation of whether we process your personal data and obtain a copy of that information, together with certain information about how it is processed.
Right to rectification: You may ask us to correct personal data that is inaccurate or complete information that is incomplete.
Right to erasure: You may ask us to delete your personal data in certain circumstances, including where it is no longer required for the purpose for which it was collected.
Right to restriction: You may ask us to restrict the processing of your personal data in certain circumstances, including while its accuracy or the lawfulness of its processing is being considered.
Right to object: You may object to processing based on our legitimate interests for reasons relating to your particular circumstances. We may continue processing where we can demonstrate compelling legitimate grounds or where processing is necessary for the establishment, exercise or defence of legal claims.
Right to object to direct marketing: You may object at any time to the use of your personal data for direct-marketing purposes. Where you object, we will stop using your personal data for those purposes.
Right to data portability: Where processing is carried out by automated means and is based on your consent or a contract with you, you may be entitled to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Rights concerning automated decisions: You have rights in relation to certain decisions based solely on automated processing that produce legal or similarly significant effects. CJFA does not use personal data collected through this website to make decisions of this kind.

These rights do not apply in every circumstance and may be subject to exemptions or restrictions under applicable law. If we cannot comply fully with a request, we will explain the reason, unless the law prevents us from doing so.

How to Exercise Your Rights

You may exercise your data-protection rights by contacting us:

Email: mail@cjfa.ie

Post:
C.J. Falconer & Associates, trading as CJ Falconer Architects
St. Patrick’s House
Newtown
Waterford
X91 RR76
Ireland

Please explain which right you wish to exercise and provide sufficient information to help us identify you and locate the relevant personal data.

Where we have reasonable doubts about your identity, we may request additional information necessary to verify it. This is intended to ensure that personal data is not disclosed to someone who is not entitled to receive it. We will only request information that is reasonably necessary for this purpose.

We will respond to your request without undue delay and normally within one month of receiving it. Where permitted by law, this period may be extended by up to two further months if the request is complex or if we have received a number of requests. If an extension is required, we will inform you within one month of receiving your request and explain the reason for it.

Requests to exercise your rights are normally handled free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee based on the administrative costs involved or refuse to act on the request. If we refuse to act or apply a fee, we will explain the reason and inform you of the remedies available to you.

Right to Complain

If you have a concern about how we collect or use your personal data, we would appreciate the opportunity to address it. You can contact us at mail@cjfa.ie.

You also have the right to raise a concern or lodge a complaint with the Data Protection Commission, which is the supervisory authority responsible for data protection in Ireland.

The Data Protection Commission can be contacted at:

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland

You can also submit a concern or complaint using the Data Protection Commission’s online contact form.

Your right to contact the Data Protection Commission is not affected by any attempt to resolve the matter with us directly.

Links to Other Websites

Our website contains links to websites and services operated by third parties, including social-media platforms, mapping services and other external resources.

This may include links that allow you to visit or share content through services such as LinkedIn. When you select an external link, you leave the CJFA website and the relevant third party may collect and use personal data in accordance with its own privacy policy.

CJFA does not control and is not responsible for the content, availability, security or privacy practices of third-party websites. We recommend reviewing the privacy information provided by the relevant third party before submitting personal data or using its services.

A link to an external website does not, by itself, mean that CJFA endorses that website or its privacy practices.

Changes to This Policy

We may update this Privacy and Cookies Policy from time to time to reflect changes to our website, services, data-processing practices or legal obligations.

Any revised Policy will be published on this page. The date of the most recent revision will be shown in the “Last updated” notice at the top of the page.

Where a change materially affects how we use personal data, we will provide an additional notice where required by law.

Contact

If you have any questions about this Privacy and Cookies Policy, how we process personal data or how to exercise your data-protection rights, please contact us: